> Not deflecting the stupidity and criminality of 23andme...how stupid can a corporation working with this sensitive type of data be

Really? If the article is accurate, 23andMe did not have a security breach; credentials leaked in other breaches were used to compromise accounts that reused those credentials on 23andMe. Now certainly 2FA would have been advisable, but I think it's a bit much to suggest this rises to the level of criminality.